I have little experience in being a web application administrator however I am a software developer. I inherited support for a legacy application that jkMount's a JBoss application server farm and the front end are two Apache 2.2.8 with OpenSSL servers preconfigured and running on Windows Server 2003.
The recent publicized security flaw triggered a response from my manager that I need to upgrade the Apache servers to the most secure version, 2.2.21.
I believe I know what I need to do in theory but I have never personally installed or upgraded Apache before so I am a little nervous. My plan was to:
Backup the existing installation location completely
Stop the Apache Servers
Install to the same location via the MSI installer I downloaded
Replace the installed contents of the
/conf/directory with the backed up contents of the pre-configured
/conf/directory (including SSL certs).
Restart the servers and pray to God/Allah/Spaghetti Monster.
Do you see anything that I may be missing? I imagine the only differences between 2.2.8 and 2.2.21 are just security updates and that configuration files should be interchangeable?